Migrate ( metasploit, exploit-db, kev ) to aboutcode pipeline.

Set data_source as the header for the exploit table.
Squash the migration files into a single file.
Add test for exploit-db , metasploit
Add a missing migration file
Rename resources_and_notes to notes
Fix Api test
Refactor metasploit , exploitdb , kev improver
Rename Kev tab to exploit tab
Add support for exploitdb , metasploit, kev

Signed-off-by: ziadhany <ziadhany2016@gmail.com>

vulnerabilities/api.py

@@ -27,7 +27,7 @@
 from rest_framework.throttling import UserRateThrottle
 
 from vulnerabilities.models import Alias
-from vulnerabilities.models import Kev
+from vulnerabilities.models import Exploit
 from vulnerabilities.models import Package
 from vulnerabilities.models import Vulnerability
 from vulnerabilities.models import VulnerabilityReference
@@ -175,10 +175,23 @@ def to_representation(self, instance):
         return representation
 
 
-class KEVSerializer(serializers.ModelSerializer):
+class ExploitSerializer(serializers.ModelSerializer):
     class Meta:
-        model = Kev
-        fields = ["date_added", "description", "required_action", "due_date", "resources_and_notes"]
+        model = Exploit
+        fields = [
+            "date_added",
+            "description",
+            "required_action",
+            "due_date",
+            "notes",
+            "known_ransomware_campaign_use",
+            "source_date_published",
+            "exploit_type",
+            "platform",
+            "source_date_updated",
+            "data_source",
+            "source_url",
+        ]
 
 
 class VulnerabilitySerializer(BaseResourceSerializer):
@@ -189,7 +202,7 @@ class VulnerabilitySerializer(BaseResourceSerializer):
 
     references = VulnerabilityReferenceSerializer(many=True, source="vulnerabilityreference_set")
     aliases = AliasSerializer(many=True, source="alias")
-    kev = KEVSerializer(read_only=True)
+    exploits = ExploitSerializer(many=True, read_only=True)
     weaknesses = WeaknessSerializer(many=True)
     severity_range_score = serializers.SerializerMethodField()
 
@@ -199,10 +212,6 @@ def to_representation(self, instance):
         weaknesses = data.get("weaknesses", [])
         data["weaknesses"] = [weakness for weakness in weaknesses if weakness is not None]
 
-        kev = data.get("kev", None)
-        if not kev:
-            data.pop("kev")
-
         return data
 
     def get_severity_range_score(self, instance):
@@ -240,7 +249,7 @@ class Meta:
             "affected_packages",
             "references",
             "weaknesses",
-            "kev",
+            "exploits",
             "severity_range_score",
         ]
 

vulnerabilities/improvers/__init__.py

@@ -8,9 +8,11 @@
 #
 
 from vulnerabilities.improvers import valid_versions
-from vulnerabilities.improvers import vulnerability_kev
 from vulnerabilities.improvers import vulnerability_status
+from vulnerabilities.pipelines import exploitdb
 from vulnerabilities.pipelines import flag_ghost_packages
+from vulnerabilities.pipelines import metasploit
+from vulnerabilities.pipelines import vulnerability_kev
 
 IMPROVERS_REGISTRY = [
     valid_versions.GitHubBasicImprover,
@@ -29,7 +31,9 @@
     valid_versions.RubyImprover,
     valid_versions.GithubOSVImprover,
     vulnerability_status.VulnerabilityStatusImprover,
-    vulnerability_kev.VulnerabilityKevImprover,
+    vulnerability_kev.VulnerabilityKevPipeline,
+    metasploit.MetasploitImproverPipeline,
+    exploitdb.ExploitDBImproverPipeline,
     flag_ghost_packages.FlagGhostPackagePipeline,
 ]
 

vulnerabilities/migrations/0063_exploit_delete_kev.py

@@ -0,0 +1,131 @@
+# Generated by Django 4.1.13 on 2024-09-10 18:40
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("vulnerabilities", "0062_package_is_ghost"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="Exploit",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True, primary_key=True, serialize=False, verbose_name="ID"
+                    ),
+                ),
+                (
+                    "date_added",
+                    models.DateField(
+                        blank=True,
+                        help_text="The date the vulnerability was added to an exploit catalog.",
+                        null=True,
+                    ),
+                ),
+                (
+                    "description",
+                    models.TextField(
+                        blank=True,
+                        help_text="Description of the vulnerability in an exploit catalog, often a refinement of the original CVE description",
+                        null=True,
+                    ),
+                ),
+                (
+                    "required_action",
+                    models.TextField(
+                        blank=True,
+                        help_text="The required action to address the vulnerability, typically to apply vendor updates or apply vendor mitigations or to discontinue use.",
+                        null=True,
+                    ),
+                ),
+                (
+                    "due_date",
+                    models.DateField(
+                        blank=True,
+                        help_text="The date the required action is due, which applies to all USA federal civilian executive branch (FCEB) agencies, but all organizations are strongly encouraged to execute the required action",
+                        null=True,
+                    ),
+                ),
+                (
+                    "notes",
+                    models.TextField(
+                        blank=True,
+                        help_text="Additional notes and resources about the vulnerability, often a URL to vendor instructions.",
+                        null=True,
+                    ),
+                ),
+                (
+                    "known_ransomware_campaign_use",
+                    models.BooleanField(
+                        default=False,
+                        help_text="Known' if this vulnerability is known to have been leveraged as part of a ransomware campaign; \n        or 'Unknown' if there is no confirmation that the vulnerability has been utilized for ransomware.",
+                    ),
+                ),
+                (
+                    "source_date_published",
+                    models.DateField(
+                        blank=True,
+                        help_text="The date that the exploit was published or disclosed.",
+                        null=True,
+                    ),
+                ),
+                (
+                    "exploit_type",
+                    models.TextField(
+                        blank=True,
+                        help_text="The type of the exploit as provided by the original upstream data source.",
+                        null=True,
+                    ),
+                ),
+                (
+                    "platform",
+                    models.TextField(
+                        blank=True,
+                        help_text="The platform associated with the exploit as provided by the original upstream data source.",
+                        null=True,
+                    ),
+                ),
+                (
+                    "source_date_updated",
+                    models.DateField(
+                        blank=True,
+                        help_text="The date the exploit was updated in the original upstream data source.",
+                        null=True,
+                    ),
+                ),
+                (
+                    "data_source",
+                    models.TextField(
+                        blank=True,
+                        help_text="The source of the exploit information, such as CISA KEV, exploitdb, metaspoit, or others.",
+                        null=True,
+                    ),
+                ),
+                (
+                    "source_url",
+                    models.URLField(
+                        blank=True,
+                        help_text="The URL to the exploit as provided in the original upstream data source.",
+                        null=True,
+                    ),
+                ),
+                (
+                    "vulnerability",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="exploits",
+                        to="vulnerabilities.vulnerability",
+                    ),
+                ),
+            ],
+        ),
+        migrations.DeleteModel(
+            name="Kev",
+        ),
+    ]

vulnerabilities/models.py

@@ -1378,49 +1378,90 @@ def log_fixing(cls, package, importer, source_url, related_vulnerability):
         )
 
 
-class Kev(models.Model):
+class Exploit(models.Model):
     """
-    Known Exploited Vulnerabilities
+    A vulnerability exploit is code used to
+    take advantage of a security flaw for unauthorized access or malicious activity.
     """
 
-    vulnerability = models.OneToOneField(
+    vulnerability = models.ForeignKey(
         Vulnerability,
+        related_name="exploits",
         on_delete=models.CASCADE,
-        related_name="kev",
     )
 
     date_added = models.DateField(
-        help_text="The date the vulnerability was added to the Known Exploited Vulnerabilities"
-        " (KEV) catalog in the format YYYY-MM-DD.",
         null=True,
         blank=True,
+        help_text="The date the vulnerability was added to an exploit catalog.",
     )
 
     description = models.TextField(
-        help_text="Description of the vulnerability in the Known Exploited Vulnerabilities"
-        " (KEV) catalog, usually a refinement of the original CVE description"
+        null=True,
+        blank=True,
+        help_text="Description of the vulnerability in an exploit catalog, often a refinement of the original CVE description",
     )
 
     required_action = models.TextField(
+        null=True,
+        blank=True,
         help_text="The required action to address the vulnerability, typically to "
-        "apply vendor updates or apply vendor mitigations or to discontinue use."
+        "apply vendor updates or apply vendor mitigations or to discontinue use.",
     )
 
     due_date = models.DateField(
-        help_text="The date the required action is due in the format YYYY-MM-DD,"
-        "which applies to all USA federal civilian executive branch (FCEB) agencies,"
-        "but all organizations are strongly encouraged to execute the required action."
+        null=True,
+        blank=True,
+        help_text="The date the required action is due, which applies"
+        " to all USA federal civilian executive branch (FCEB) agencies, "
+        "but all organizations are strongly encouraged to execute the required action",
     )
 
-    resources_and_notes = models.TextField(
+    notes = models.TextField(
+        null=True,
+        blank=True,
         help_text="Additional notes and resources about the vulnerability,"
-        " often a URL to vendor instructions."
+        " often a URL to vendor instructions.",
     )
 
     known_ransomware_campaign_use = models.BooleanField(
         default=False,
-        help_text="""Known if this vulnerability is known to have been leveraged as part of a ransomware campaign;
-        or 'Unknown' if CISA lacks confirmation that the vulnerability has been utilized for ransomware.""",
+        help_text="""Known' if this vulnerability is known to have been leveraged as part of a ransomware campaign; 
+        or 'Unknown' if there is no confirmation that the vulnerability has been utilized for ransomware.""",
+    )
+
+    source_date_published = models.DateField(
+        null=True, blank=True, help_text="The date that the exploit was published or disclosed."
+    )
+
+    exploit_type = models.TextField(
+        null=True,
+        blank=True,
+        help_text="The type of the exploit as provided by the original upstream data source.",
+    )
+
+    platform = models.TextField(
+        null=True,
+        blank=True,
+        help_text="The platform associated with the exploit as provided by the original upstream data source.",
+    )
+
+    source_date_updated = models.DateField(
+        null=True,
+        blank=True,
+        help_text="The date the exploit was updated in the original upstream data source.",
+    )
+
+    data_source = models.TextField(
+        null=True,
+        blank=True,
+        help_text="The source of the exploit information, such as CISA KEV, exploitdb, metaspoit, or others.",
+    )
+
+    source_url = models.URLField(
+        null=True,
+        blank=True,
+        help_text="The URL to the exploit as provided in the original upstream data source.",
     )
 
     @property